TeamViewer bulletin TV-2026-1011 (Oct 27) fixes three high-severity client flaws: CVE-2026-92372, CVE-2026-92374 and CVE-2026-111585. The last one reverses the usual direction of a remote-support attack: an integer overflow in the viewer's remote-control screen processing lets a malicious or compromised host send crafted screen data that overflows a heap buffer on the viewer, causing a crash or, depending on the platform, code execution with the viewer's privileges. The victim only has to start a remote-control session to that host.

• Affected (CVE-2026-111585): Full Client and Portable before 15.83 on Windows, Linux and macOS, and the Android Remote Control app before 15.83, plus the legacy 15.64, 14.7 and 13.2 branches.
• Fixed: 15.83 (Full Client, Host, Portable, Android app); legacy 15.64.10, 14.7.48868, and 13.2.36231 (Windows) / 13.2.154008 (Linux) / 13.2.154007 (macOS). The Host is not listed for this CVE but the same update fixes the bulletin's other two flaws, which do affect it.
• Exploitation: TeamViewer says it is not aware of exploitation in the wild; France's CERT Santé lists no public proof of concept. Researchers at Remedio say they reached code execution on a Windows viewer with default settings, per SecurityWeek.

Do now: update help-desk and MSP technician machines first, since they connect out to many untrusted endpoints. No workaround is listed.